CVE-2022-26148

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 21-03-2022 09:15

Last modified: - 13-05-2022 01:59

Total changes: - 5

Description

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Low

Attack complexity

Network

Attack vector

High

Availability

High

Confidentiality

High

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

9.8

Base score

3.9

5.9

Exploitability score

Impact score

Verification logic

vendor=grafana AND product=grafana AND versionEndIncluding=7.3.4

vendor=Red Hat Enterprise Linux AND product=ceph_storage AND version=3.0

vendor=Red Hat Enterprise Linux AND product=storage AND version=3.0

vendor=Red Hat Enterprise Linux AND product=ceph_storage AND version=4.0

vendor=Red Hat Enterprise Linux AND product=ceph_storage AND version=5.0

Reference

Keywords

CVE-2022-26148

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2022-26148

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures